CVE-2025-13171

HighCVSS 8.8/10Last modified Oct 19, 2026

Description

A vulnerability was identified in ZZCMS 2023. This impacts an unknown function of the file /admin/wangkan_list.php. Such manipulation of the argument keyword leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
n/a	ZZCMS	2023

References

https://github.com/En0t5/vul/blob/main/zzcms/zzcms-sql-inject2.mdExploit, Third Party Advisory
https://github.com/En0t5/vul/blob/main/zzcms/zzcms-sql-inject2.md#pocExploit, Third Party Advisory
https://vuldb.com/?ctiid.332463Permissions Required, VDB Entry
https://vuldb.com/?id.332463Third Party Advisory, VDB Entry
https://vuldb.com/?submit.684765Third Party Advisory, VDB Entry

Timeline

Published: Nov 14, 2025
Last modified: Oct 19, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-131728.8A security flaw has been discovered in CodeAstro Gym Management System 1.0. Affected is an unknown function of the file /admin/view-member-r CVE-2025-131736.5Tokens associated with user sessions are not revoked when the corresponding user session is terminated, unless another SSO request is initia CVE-2025-131746.3A weakness has been identified in rachelos WeRSS we-mp-rss up to 1.4.7. Affected by this vulnerability is the function do_job of the file /r CVE-2025-131755.1Y Soft SafeQ 6 renders the Workflow Connector password field in a way that allows an administrator with UI access to reveal the value using CVE-2025-131768.4Planting a custom configuration file in ESET Inspect Connector allow load a malicious DLL.CVE-2025-131778.8A vulnerability was detected in Bdtask/CodeCanyon SalesERP up to 20250728. This affects an unknown part. The manipulation results in cross-s CVE-2025-131785.4A flaw has been found in Bdtask/CodeCanyon SalesERP up to 20250728. This vulnerability affects unknown code of the file /edit_profile of the CVE-2025-131796.5A vulnerability has been found in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to 20250320. This issue a CVE-2025-131805.4A vulnerability was found in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to 20250320. Impacted is an un CVE-2025-131814.8A vulnerability was determined in pojoin h3blog 1.0. The affected element is an unknown function of the file /admin/cms/material/add. Execut CVE-2025-131824.8A vulnerability was identified in pojoin h3blog 1.0. The impacted element is an unknown function of the file /admin/cms/category/addtitle. T CVE-2025-131837.3Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hotech Software Inc. Otello all